I should also say, that because we generate our own tarball from the upstream source control, the md5sums will likely always be different due to timestamps. This is a common problem for packages whose upstream do not ship tarballs.